Very mixed feelings on GitHub’s recent approaches to security. Tighter security measures are great, but deprecating password authentication on git operations seems obtuse to me. What if I want to push a change from a machine that’s not mine and doesn’t have my registered SSH key on it? I don’t have a Yubikey or anything similar nor do I intend to get one in the foreseeable future.
I’m with you on this. How on earth are one-off login events supposed to work? I want nothing about me logging on to be stored on that device or account other than, for example, the code I download. Maybe I’m missing something but the search I just did suggested connecting my phone via bluetooth, which is also not an option.
For anyone else trying to get it to work on firefox, it doesn’t support passkeys yet but it’s on the roadmap. https://connect.mozilla.org/t5/ideas/support-webauthn-passkeys/idc-p/30123/highlight/true#M17028
Firefox does support Passkeys - it’s just incomplete - specifically some of the major key storage locations aren’t supported yet (and it depends what operating system you’re running Firefox on, since every OS has different options for secure key storage).
I like it on principle, but haven’t tried any passkey stuff yet. Truth be told, I kinda liked SQRL, but that is clearly going nowhere.
SQRL’s problem is it only focuses on the login component. It doesn’t really solve storage/backup/sync. All three have to be extremely easy to use otherwise any authentication system is a non-starter for the general public.
Passwords might not be secure, but they are user friendly (if you allow bad passwords). That ease of use cannot be taken away.
Excellent point. I’ve got exactly one SQRL login and even it was just to play with it. I never got as far as real world considerations. :)
